Sigma rule converter

It compiles the common Sigma shapes: one-level selections, the standard value modifiers (contains, startswith, endswith, all, re, gt and friends, exists), the boolean condition language with 1 of and all of, and the keyword field. It is not pySigma. Encodings like base64 and wide, %placeholders%, correlated field lists, and mid-string wildcards on KQL are refused and listed rather than guessed at, and anything listed in the losses above was left out of the query. Aggregation conditions (count, sum) belong in a correlation rule, not a plain search, so the converter emits the filter part and says so. Regex dialects differ per backend, and the field maps are a starter set, not the full pipeline catalogue. Test every query against your own SIEM before you rely on it.